Word 打字机演示

• Outcome: Review
• Latest audit: May 28, 2026 · 9:27 AM UTC
• Version: 1.0.0

Overview

This is mostly a Word typing demo, but it can silently alter or close unsaved Word documents and includes broad demo scenarios outside its stated purpose.

Install only for a controlled local Word/WPS demo. Before running it, save or close important Word documents, provide an explicit output path, and use non-sensitive input content. Treat content_demo.txt as sample presentation text only; do not treat its file-search, browser, code, or email workflows as safe automation instructions without separate approvals and safeguards.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The script enumerates unsaved documents and may close or reuse them, even though they are outside the demo workflow. In get_or_create_doc it can select an unrelated unsaved document and delete its contents, and in cleanup_blank_docs it closes documents judged to be blank by name heuristics, creating a real risk of user data loss.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This skill is designed to automate Word/WPS and modify document contents, formatting, pagination, alignment, and post-process the whole document with automatic corrections, but the user-facing description does not prominently warn that it will actively write to and alter documents. In an office-automation context, insufficient disclosure can lead users to run it on the wrong open document or underestimate the scope of changes, causing integrity loss or accidental overwrites of important files.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill describes activation through generic QQ/WeChat messages without any constrained trigger phrases, approval gates, or task boundaries. In context, this is risky because the demonstrated actions include locating files and sending them back, so an overly broad invocation surface could cause accidental or unauthorized execution from ambiguous chat messages.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The browser-operation scenario says only that the user can message the assistant to operate the browser, but provides no narrow trigger or action restrictions. Because browser control can reach arbitrary sites and perform sensitive actions, ambiguous activation increases the chance of unintended web navigation, phishing interaction, or misuse via loosely worded instructions.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The daily-report workflow is initiated by a generic chat instruction and then grants broad authority to read emails, summarize departmental messages, generate documents, and send email externally. In this context, the lack of precise invocation boundaries is more dangerous because it touches sensitive communications and outbound transmission, creating risk of unauthorized data access, accidental disclosure, or execution of spoofed instructions.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code deletes the content of an existing unsaved document without confirming ownership, provenance, or user intent. In a Word automation context, an unsaved document may contain active user work, so silent deletion can immediately destroy data and is especially dangerous because the script suppresses alerts and runs automatically.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.